From 94052adea6825de2cd18d9dd245d462b63b90053 Mon Sep 17 00:00:00 2001
From: Seth Etter <mail@sethetter.com>
Date: Fri, 11 Sep 2026 15:52:46 -0500
Subject: [PATCH] brewfile: guard mac-only formulae; fill empty gnome input
 sources

- mas, iproute2mac, terminal-notifier have no Linux support; brew bundle
  skips casks and mas entries on Linux automatically but not mac-only
  formulae, so guard them with 'if OS.mac?'
- setup.yml now sets org.gnome.desktop.input-sources sources to
  [('xkb', 'us')] when empty; GNOME ignores xkb-options (caps lock
  mapping) while it has no managed layout
---
 Brewfile                 |  6 +++---
 debian/README.md         |  3 ++-
 debian/ansible/setup.yml | 25 +++++++++++++++++++++++++
 3 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/Brewfile b/Brewfile
index 21531fd..5549842 100644
--- a/Brewfile
+++ b/Brewfile
@@ -56,7 +56,7 @@ brew "restic"
 cask "hammerspoon"
 brew "goat"
 brew "nmap"
-brew "iproute2mac"
+brew "iproute2mac" if OS.mac?
 brew "mtr"
 brew "wireshark"
 brew "nikto"
@@ -75,7 +75,7 @@ cask "ngrok"
 brew "pandoc"
 brew "imagemagick"
 brew "ffmpeg"
-brew "terminal-notifier"
+brew "terminal-notifier" if OS.mac?
 brew "oath-toolkit"
 brew "openconnect"
 brew "openvpn"
@@ -102,7 +102,7 @@ brew "glab"
 tap "atlassian/homebrew-acli", trusted: true
 brew "acli"
 brew "ghorg"
-brew "mas"
+brew "mas" if OS.mac?
 
 # Libs
 brew "yubikey-personalization"
diff --git a/debian/README.md b/debian/README.md
index c716324..05f9bd8 100644
--- a/debian/README.md
+++ b/debian/README.md
@@ -37,7 +37,8 @@ ansible-playbook ~/dotfiles/debian/ansible/update.yml --ask-become-pass
   force-install policy
 - clones dotfiles to `~/dotfiles` and runs `sync.sh`
 - homebrew at `/home/linuxbrew/.linuxbrew`, then brewsync
-  (`brew bundle --zap --force-cleanup`; casks are skipped on Linux)
+  (`brew bundle --zap --force-cleanup`; casks and `mas` entries are skipped
+  on Linux; mac-only formulae need an `if OS.mac?` guard in the Brewfile)
 - `mise install` for all tools in the mise config
 - caps lock mapped to ctrl; login shell → zsh; default browser → Helium
 - unattended security upgrades (daily, Debian's stock config)
diff --git a/debian/ansible/setup.yml b/debian/ansible/setup.yml
index 36cd1f2..432840c 100644
--- a/debian/ansible/setup.yml
+++ b/debian/ansible/setup.yml
@@ -232,6 +232,31 @@
         shell: /usr/bin/zsh
       become: true
 
+    - name: Read keyboard input sources
+      ansible.builtin.command:
+        argv:
+          - gsettings
+          - get
+          - org.gnome.desktop.input-sources
+          - sources
+      register: kb_sources
+      changed_when: false
+      become: false
+
+    # An empty sources list leaves GNOME without a managed keyboard layout,
+    # and xkb-options (caps lock) are then ignored. Only fills it in when
+    # empty, so custom layouts are never clobbered.
+    - name: Set default keyboard layout when none configured
+      ansible.builtin.command:
+        argv:
+          - gsettings
+          - set
+          - org.gnome.desktop.input-sources
+          - sources
+          - "[('xkb', 'us')]"
+      when: kb_sources.stdout | trim in ['@as []', '[]']
+      become: false
+
     - name: Read keyboard xkb options
       ansible.builtin.command:
         argv:
-- 
2.51.2